Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 10:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
35 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
19 signatures
150 seconds
General
- Target 2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe
- Size 15.8MB
- Sample260601-mcvefsbs7p
- SHA256 1580feeb237d9ddde6117080fdfa914d8c6aa0434dcfa7dd08bbe9fbfa50f6d1
- MD5 f839422992ab4c3cafec4848e8a4eb29
- SHA1 94c37004b5e4c6d1fea2ef323649e89812125050
- SHA512 f072710c264509a5e95e75d7030d0a540d9e38cb14a0c00d70973ddeb71a34a40f6452f33d69532428eade77638ba1551e68f795930e97ad23610213d6d5a03a
- SSDEEP 393216:Pf23zLpejEqYjHBOXEG74aeonFd5VDxbc:PO3vZHB8sVoH5Vm
- TLSH T11DF63309738B22B8D02E71F9F044F1004AF5BD27EF1D9B5F199172678BF6A742D25AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" vycouko4.exe - Detects Reflective DLL injection artifacts 3 IoCs
resource yara_rule behavioral2/files/0x001a00000002b627-70.dat INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/files/0x001900000002b62f-170.dat INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/2936-403-0x000001DC21DB0000-0x000001DC21DB3000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader - Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
resource yara_rule behavioral2/files/0x001a00000002b624-37.dat INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral2/files/0x001a00000002b624-37.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/files/0x001900000002b628-440.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys" WinSysKdrv.exe - Executes dropped EXE 23 IoCs
pid Process 5780 ecm0w1ao.exe 712 ghclv8do.exe 5356 p73r96hg.exe 2064 rldm7g9s.exe 3292 Explorer.EXE 5448 4utoxomf.exe 1484 1qzm8ymo.exe 2484 vycouko4.exe 4720 88geecrb.exe 1132 scjit9vp.exe 2136 dwrvc.exe 1216 WinSysKdrv.exe 4864 svchost.exe 5504 winsysdrv.exe 2236 WindowsStore.Update.exe 5172 winhost.exe 1416 dwrvc.exe 5052 winsysdrv.exe 5804 EmbeddedDriverService.sys 5252 dwrvc.exe 5224 jfeqg.exe 2800 jfeqg.exe 4648 vycouko4.exe - Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\winsysdrv.exe" 4utoxomf.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\ProgramData\\winsysdrv.exe" winsysdrv.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\winsysdrv.exe" winsysdrv.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\juldj = "C:\\ProgramData\\jfeqg.exe" 88geecrb.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vycouko4.exe" vycouko4.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe" p73r96hg.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSvcHost = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\WindowsStore.Update.exe" rldm7g9s.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: vycouko4.exe File opened (read-only) \??\S: vycouko4.exe File opened (read-only) \??\U: vycouko4.exe File opened (read-only) \??\V: vycouko4.exe File opened (read-only) \??\Y: vycouko4.exe File opened (read-only) \??\Z: vycouko4.exe File opened (read-only) \??\J: vycouko4.exe File opened (read-only) \??\R: vycouko4.exe File opened (read-only) \??\W: vycouko4.exe File opened (read-only) \??\E: vycouko4.exe File opened (read-only) \??\I: vycouko4.exe File opened (read-only) \??\M: vycouko4.exe File opened (read-only) \??\N: vycouko4.exe File opened (read-only) \??\T: vycouko4.exe File opened (read-only) \??\A: vycouko4.exe File opened (read-only) \??\G: vycouko4.exe File opened (read-only) \??\H: vycouko4.exe File opened (read-only) \??\K: vycouko4.exe File opened (read-only) \??\L: vycouko4.exe File opened (read-only) \??\O: vycouko4.exe File opened (read-only) \??\Q: vycouko4.exe File opened (read-only) \??\X: vycouko4.exe File opened (read-only) \??\B: vycouko4.exe - Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
resource yara_rule behavioral2/files/0x001900000002b632-209.dat costura - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsysdrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4utoxomf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vycouko4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1qzm8ymo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsysdrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ vycouko4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 88geecrb.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2488 schtasks.exe 4192 schtasks.exe 5464 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe 5780 ecm0w1ao.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3292 Explorer.EXE - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 1216 WinSysKdrv.exe 1216 WinSysKdrv.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2064 rldm7g9s.exe Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeLoadDriverPrivilege 1216 WinSysKdrv.exe Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeLoadDriverPrivilege 1216 WinSysKdrv.exe Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 5096 wrote to memory of 5780 5096 2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe 81 PID 5096 wrote to memory of 712 5096 2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe 82 PID 5096 wrote to memory of 5356 5096 2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe 83 PID 5096 wrote to memory of 2064 5096 2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe 84 PID 5096 wrote to memory of 5448 5096 2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe 86 PID 5448 wrote to memory of 2488 5448 4utoxomf.exe 87 PID 5096 wrote to memory of 1484 5096 2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe 89 PID 5096 wrote to memory of 2484 5096 2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe 91 PID 3292 wrote to memory of 5868 3292 Explorer.EXE PID 3292 wrote to memory of 2104 3292 Explorer.EXE PID 3292 wrote to memory of 3864 3292 Explorer.EXE PID 5096 wrote to memory of 4720 5096 2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe 95 PID 5096 wrote to memory of 1132 5096 2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe 96 PID 1132 wrote to memory of 2936 1132 scjit9vp.exe 51 PID 1132 wrote to memory of 3116 1132 scjit9vp.exe 53 PID 1132 wrote to memory of 3292 1132 scjit9vp.exe 54 PID 1132 wrote to memory of 3820 1132 scjit9vp.exe 59 PID 1132 wrote to memory of 3888 1132 scjit9vp.exe 60 PID 1132 wrote to memory of 804 1132 scjit9vp.exe 90 PID 1132 wrote to memory of 5868 1132 scjit9vp.exe PID 1132 wrote to memory of 2104 1132 scjit9vp.exe PID 1132 wrote to memory of 3864 1132 scjit9vp.exe PID 1132 wrote to memory of 1004 1132 scjit9vp.exe 92 PID 1132 wrote to memory of 4536 1132 scjit9vp.exe 93 PID 1132 wrote to memory of 4392 1132 scjit9vp.exe 94 PID 3292 wrote to memory of 3560 3292 Explorer.EXE PID 5448 wrote to memory of 2136 5448 4utoxomf.exe 98 PID 2136 wrote to memory of 3292 2136 dwrvc.exe 54 PID 5504 wrote to memory of 4192 5504 winsysdrv.exe 103 PID 3292 wrote to memory of 5124 3292 Explorer.EXE PID 3292 wrote to memory of 5784 3292 Explorer.EXE PID 5504 wrote to memory of 1416 5504 winsysdrv.exe 108 PID 1416 wrote to memory of 3292 1416 dwrvc.exe 54 PID 5052 wrote to memory of 5464 5052 winsysdrv.exe 110 PID 5052 wrote to memory of 5252 5052 winsysdrv.exe 113 PID 5252 wrote to memory of 3292 5252 dwrvc.exe 54 PID 4720 wrote to memory of 5224 4720 88geecrb.exe 114 PID 3292 wrote to memory of 668 3292 Explorer.EXE PID 3292 wrote to memory of 3500 3292 Explorer.EXE - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2936
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3116
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_f839422992ab4c3cafec4848e8a4eb29_cobalt-strike_icedid_satacom_vidar.exe"2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\ecm0w1ao.exe"C:\Users\Admin\AppData\Local\Temp\ecm0w1ao.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5780
-
-
C:\Users\Admin\AppData\Local\Temp\ghclv8do.exe"C:\Users\Admin\AppData\Local\Temp\ghclv8do.exe"3⤵
- Executes dropped EXE
PID:712
-
-
C:\Users\Admin\AppData\Local\Temp\p73r96hg.exe"C:\Users\Admin\AppData\Local\Temp\p73r96hg.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5356
-
-
C:\Users\Admin\AppData\Local\Temp\rldm7g9s.exe"C:\Users\Admin\AppData\Local\Temp\rldm7g9s.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
-
C:\Users\Admin\AppData\Local\Temp\4utoxomf.exe"C:\Users\Admin\AppData\Local\Temp\4utoxomf.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Roaming\winsysdrv.exe" /sc onlogon /rl highest /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2488
-
-
C:\Users\Admin\AppData\Roaming\dwrvc.exe"C:\Users\Admin\AppData\Roaming\dwrvc.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136
-
-
-
C:\Users\Admin\AppData\Local\Temp\1qzm8ymo.exe"C:\Users\Admin\AppData\Local\Temp\1qzm8ymo.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:804
-
-
-
C:\Users\Admin\AppData\Local\Temp\vycouko4.exe"C:\Users\Admin\AppData\Local\Temp\vycouko4.exe"3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\88geecrb.exe"C:\Users\Admin\AppData\Local\Temp\88geecrb.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\ProgramData\jfeqg.exe"C:\ProgramData\jfeqg.exe"4⤵
- Executes dropped EXE
PID:5224
-
-
-
C:\Users\Admin\AppData\Local\Temp\scjit9vp.exe"C:\Users\Admin\AppData\Local\Temp\scjit9vp.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3820
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3888
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:1004
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4536
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
C:\Users\Admin\Pictures\svchost.exeC:\Users\Admin\Pictures\svchost.exe1⤵
- Executes dropped EXE
PID:4864
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\WindowsStore.Update.exeC:\Users\Admin\AppData\Local\Microsoft\WindowsApps\WindowsStore.Update.exe1⤵
- Executes dropped EXE
PID:2236
-
C:\Users\Admin\AppData\Roaming\winsysdrv.exeC:\Users\Admin\AppData\Roaming\winsysdrv.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "WindowsUpdate" /tr "C:\ProgramData\winsysdrv.exe" /sc onlogon /rl highest /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4192
-
-
C:\ProgramData\dwrvc.exe"C:\ProgramData\dwrvc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe1⤵
- Executes dropped EXE
PID:5172
-
C:\ProgramData\winsysdrv.exeC:\ProgramData\winsysdrv.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Roaming\winsysdrv.exe" /sc onlogon /rl highest /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5464
-
-
C:\Users\Admin\AppData\Roaming\dwrvc.exe"C:\Users\Admin\AppData\Roaming\dwrvc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252
-
-
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sysC:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys1⤵
- Executes dropped EXE
PID:5804
-
C:\ProgramData\jfeqg.exeC:\ProgramData\jfeqg.exe1⤵
- Executes dropped EXE
PID:2800
-
C:\Users\Admin\AppData\Local\Temp\vycouko4.exeC:\Users\Admin\AppData\Local\Temp\vycouko4.exe1⤵
- Executes dropped EXE
PID:4648
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\1qzm8ymo.exe
- Size 11.2MB
- SHA256 33d479af915714555802790a5111f21bcb22606c44e6018600c49ac5588ddc84
- MD5 bc11ee91c35793b787d85b1a208550a1
- SHA1 136abc0ba0af9389be256de3bb7bcb8969af197e
- SHA512 1b5109087d0972ec153f97e8f9b7d8ab13b422bff9f294103e60aa0a251a7ba07a970460b48972e5cb125b6af40ca0e2baecddc2431a13092ce9ee5db101eedc
- SSDEEP 196608:j8wbUcwti7TQlI0ndQXMJZeH0Vni0Zbylu9Yj9esJejrtHKARqc/U6qNzHbNsCtZ:j8wFwtQQlI0ndmMzs0VnitlZxevtPqcm
- TLSH T154C612EC3B250A82DECE02B6B34296015F74AE07D7F657CA3BE523C5971E3486D4D0A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\4utoxomf.exe
- Size 2.5MB
- SHA256 472db8d633e8a9a0c3a2d19ff44f08abdb28487664c8dbb17b013a28dc7e92ae
- MD5 8714dba5fba9544a282922529d5ee3fb
- SHA1 7123ea325a26a9285e8a480cceeff9059136bbc5
- SHA512 00d0457e671befc9cb801684c6615c0904e636a3289a0fd806395f730afe0a2a76b13570cf6403395121152d811d05e1c482c757b7d9d2a51b2f88115fe22db9
- SSDEEP 24576:pLksxMml5c6yiHCPc/5vXL0pCC0gePvqC:9nMmZyHcWC4eN
- TLSH T1F0C5E28D775D41ACC56244B210F10A92A7B9DB16A3E85E071BC6CC788E120DDBBBDBF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\88geecrb.exe
- Size 165KB
- SHA256 5c35e40a72e8d6e59045ea8ba951ba61aea55cdf133b93c61830a8a6f8376620
- MD5 40c2bfb087d7077a65818d9965981089
- SHA1 8e9e7bf09228633b8b9171e211749fda8ff89113
- SHA512 ac23a97226bd76287a4acd62ab1e05d252f7c07e4027ad10641925d4223b588fe5b24e0c97cb0c21c8bb62ee9204b39fb1739dca70eebd34123bc77b4e6fb468
- SSDEEP 3072:nVWeDmfnP+SMIwTjAGrN3ooK26D76NbQ4SZOr+AFk+ZqK5vYKe:9mfnP+S9wT8GrWzH6+4S8+vbw
- TLSH T163F34D0B336460F4E1779279CDA25A46E7B2787A17B1634E437443BA5F332919E3E322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
- Size 34KB
- SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
- MD5 485a04675df7cf40a8865706e003eb25
- SHA1 711ef221526997039e804a18db9647c91680bbe2
- SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
- SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
- TLSH T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
- Size 147KB
- SHA256 b47a2609a644adee63f9425c7539dd51e963733e7390e4cad667e1985baba2aa
- MD5 ee32c790c506bc8faeac05590a1472a5
- SHA1 e69a156811756c2af3c18dd12f7a1daa278b4a18
- SHA512 6512ef88fa238fcfa6512469159f8c2e71d2fd901bffa084ba4803a70ff0325a26da547850fbc71445537cc4b5d78e28df5516b400d2c8c56770136d4000a692
- SSDEEP 3072:HkHTmrWph2Pe4Kh62FgFeOWXeTLnZz8EN9lDt:AyrWpAKhhvOjHJ
- TLSH T15EE35A4363E920E9F1778678C9A58A46E771B83207209BEF07E0465A4F237D1ED3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ecm0w1ao.exe
- Size 767KB
- SHA256 0e167816dc4dc7f0dcbfd4b0a9083ce9202751dae56a13f8f6804618183796e1
- MD5 a4a020e695da9569dbead1c8d1e1c533
- SHA1 e7971942b9706ac3d40b4c6b440e02557770d5fe
- SHA512 aeba960d9d3bd708f11374bd1f9fe693af4a85dbf5a868d98e3f6bd500666a0d9031e075cd5989b3532e32886dbd49410b3adc7690426eb8c974240ed9993651
- SSDEEP 12288:cAXUMRGu4T4r7O6a9fiC9YuyxBlDetAqxSv+8:cEUPu4qy6kqQYuybX
- TLSH T1B6F49E1AF3A512FCD1BBC274CA524553EB72B8565330A69F03E14A661F336A05F3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ghclv8do.exe
- Size 225KB
- SHA256 349f2a111f84473773c4a4a89a9761b6e9b960e0baf8389b823d7eab66c2d125
- MD5 5dbbd0fcabb4370ddc60dac029a8a9e2
- SHA1 665350678b54670bca5926a7e89a7e0706be0705
- SHA512 445b7ea8b6c74b2ac83edb5d9b75703c75f164ebb879546d06749575a0881b35f06c3c39b06f2e89740b630e6789f37cee22596ce16c89f71341ecbfee43e2e3
- SSDEEP 3072:5QcTIZOCgxewOocm4Uw+BGIUkHTmrWph2Pe4Kh62FgFeOWXeTLnZz8EN9lDtx:5QcTjheXjmK8yrWpAKhhvOjHJx
- TLSH T193345B4673E924F9E1778278C9A54A46E772F8620730ABDF07A0425A1F233D1AD3DB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\p73r96hg.exe
- Size 251KB
- SHA256 5667b25447a91885e8ce5cd3fb2f79c11d8db7f4c13eb12ebd6afec11322e933
- MD5 139544af661ab3b39c076ad732e6cf49
- SHA1 af50c11258826cfbda95a5384432d3f9b8611466
- SHA512 cdde4f5a91b4a678e89173ccd41102c3ce7cf48b5765f5f25a549908bd6afe3215d45c58250ca0447acba3bda01d2e2e93baea5aa6c8aaeb34e504563173af66
- SSDEEP 3072:WU+vyj8GlM3hjRsROFoc6QFbl4Zxznjsx1XNyyRTvzKYHy1HGL5cTfixAZh:WU2yj8yMRNsRrt2J4Zcl5vbomLa0AZ
- TLSH T109447C05B7A80CFDED7B853DC9524906DB727C560760EACF07A04A965F236E09E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\rldm7g9s.exe
- Size 232KB
- SHA256 f87238a50db54c9cfb0b32dcc448d8574ea8bf7c996c8252d72dbc08532ba130
- MD5 5cbac8108792e6517885d1f3be36f2f0
- SHA1 e9d99a6a1d8d7ab6c699a05f7929902d700d8119
- SHA512 8b425d6141d48e803da888a5b7ff67e58e0e5fa80372c691b5810c418e1d74e9f0d8f3d0c1d98bb109a260368dfcb5bae3e4ef9f842ba89b58c913b07c6e0ba8
- SSDEEP 6144:30WoKA+vzDrCztaMC0u6qe9+TYqqJzLBixFBheYc:kyzDrGqE+TYp5LBN
- TLSH T13E34D057B7E434F8D57B4278C8216A06E777B43607609BAF036083662F236E15D3EBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scjit9vp.exe
- Size 40KB
- SHA256 c2ef45750d754850b8f6d448899409379489c5c4380bcf83c4ab6f61c9e01215
- MD5 fbfdd9cd005ebd2b4033086ad693cdd8
- SHA1 780e14dc895da785e14c37589d7f3ba81c11c9cd
- SHA512 502bd2b45e8c02172b7b0b7b4e5aebbfbbca649dfbb1c80c304bd9bbcbee707ee2552b56faf4e20404ce5d949e25479b6e7e59e654d9ae43998d6f7fbeba5b7c
- SSDEEP 768:QCBpYx44vJVqtuj5QmsPJ/af9TBSUp/SV9zKXjpjbCl/3Neu79ZaBu:hom4vnqtJPJSj9yEjpClFeuxiu
- TLSH T11B033A3DA29F1186DDE28978E1E622F7E670F6877D14560F8720C41D2F62903B0DCE26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vsruntime40850.tmp
- Size 109KB
- SHA256 10aabdd53dcf9afc1d987fbb5079e05c3856e1b5480e4df4d762f052cf35ba56
- MD5 15529588a11ece6e02d28aaf5d875b0d
- SHA1 28d395be90b326c63111eeb5fc24457ccbf6f9ab
- SHA512 f7ae54db243586650e2af660be0b6f94d3f99af6dae7e2ad51ec620e25739553827f1681172c2d81d5aa5b48f8cb4438f927a44764060a7102937b8b3e830eb1
- SSDEEP 1536:KDUYUvkWsLfGbpbFFCgVJ1QsSagU6wLvTDoSPJssWVd09dlbcRsh:QjUvkJLfG9bFkgBQsp6wLvTUSP0M9ca
- TLSH T135B36C5BB3E400BFE4768674C9634906D77678120B61DBAF13A082A92F737D19D3AF60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vycouko4.exe
- Size 351KB
- SHA256 a66bc218358795408a16524e753cd6032d71f6f8e8764bf95584000830e011f3
- MD5 2b87341ad3f493b0d11ec230be51c28b
- SHA1 72e13fb66da75d98d0e563128efa3441fccb122c
- SHA512 f58a8f8802b3487d682746b469ee634912cea16200e2c9684c6cd9cf59230cf4dab831183e2538b3fda9287107f9f3586ccc2fecfc8275b6e7ac3804a7a86652
- SSDEEP 3072:FsGgmNkn8/mEb+ajolYkRhzsAK8iNJseOAg0FuD0BCm55mj3q2:FO8/zbnhkfzpK8DAOgCAgx
- TLSH T14974F704A2D18BE1D461F6B81EE4C530C7196CD81BA18AFE9E7CFE158B30DA1DD315AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\dwrvc.exe
- Size 2.4MB
- SHA256 4e56d256bcc125a7e5dc7f46c28c36347ea0d67cfefdab63b2e7dd6433ceb1ff
- MD5 58a12c00541b1f50e0c10add58c17da0
- SHA1 31112f7899b5047dce851931a859103718dadac3
- SHA512 47843ffb4d058a30dcaf4fb58903c926281af76035ad977a6ec63c19da2e3563b86cfb8c5be4d5adbe667a0bf1fe35701ea2ea5503f61ff7f346d6788fa8bdcf
- SSDEEP 12288:BGuYsl4wcxOSKyiG//87gRgYafcCxlNv//8G0pDdly8ECd9EgenPvq:Uml5c6yiHCPc/5vXL0pCC0gePvq
- TLSH T196C5D18D775D41ACC55244B210F10A92A7B9DB16A3E85E071BC6CCB88E120DDBBBDBF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\Desktop - Files.lnk
- Size 592B
- SHA256 b0d08912586c3da5235d909f4b49f99a4d754d84b8763e73491d772d8647a146
- MD5 f08c22d772e4b544a2a474a4e75251c1
- SHA1 ec40e3c7e5d3a7bc3536e7546633140c17afe54e
- SHA512 be211c3c50847b549779e90631fdbe809b587381a5bfde3fb33ead2f6084b2921bb5f7d7f4bd6290a51d74b8768b80ce7b28ec746886089b82b78136445d42c6
- TLSH T16DF0C90302C74BB7C3148976283C43CDC310FC5A9A02C2DCD8C88A1478A2A028A68F73
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Desktop - Files.lnk
- Size 951B
- SHA256 cd9f2dd5df60cd4eb21b3173d308b0aa25679f635b79ff30320351dbf335dcf9
- MD5 2587c4a364a1e4f7b7c337401e539026
- SHA1 6bea477b2e6b9d5dedd3fb5ab3c059cd94496e56
- SHA512 3d2c00060a83dad6d1127555b275c992ac068b5d6f710bea7d08ec8f1ae1b7664c7556c18c3cb8bab888b5bde3ece4addfa2aaf01d2799b1f5ca0bba8a57fabf
- TLSH T19111F1026FE70F29C658E834ACF713DCC774F8684701A79D484046086A65F42EE58B2B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Downloads.lnk
- Size 757B
- SHA256 0efaaf7f9aac0124851f6bb2be697368c9f7bed0d369aad071c9336864d3ce0d
- MD5 4d0009f9473a7c12439b33f2df52a377
- SHA1 a4d697b51b266bf6548fdf5c7cb748532118f12f
- SHA512 1034a6e9e5f4edb89e64e836f1b341c121e06c3703a91bafc7207fdfa468b8e9e3822ff6bb872a47399cd9e95af6dc6ba983247212fd5c9d5b2710b7c340ff37
- TLSH T1080199165ADB0775C748E43918B447CAF610F855BD035E9C88C597482875293998CD9B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\My Documents.lnk
- Size 757B
- SHA256 136863db9e6e4cf34b0ca603ede9174cc2256a688b6a1854b5305bc75ab3971a
- MD5 083cb755d20e4a94fb50491cead3622a
- SHA1 d5cf94c46b9e48c9d61c6fa555654195731895c5
- SHA512 8f75102a421b73257b4e832d5105a3a7dc3139f03fb154ece8765e3a5b518db594637186e68a984749391fc757b81cb770854870330a9fbeb44becca05d35f4a
- TLSH T1450199165BDB0775C348E03918B487CAF610F855BD035EAC88C5974828B62A3998CD9B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Work Files.lnk
- Size 757B
- SHA256 ce1b0e0795265978688b1bcdd04815a33d81e6fa59b6a79e9e9c1c91ca8cf484
- MD5 6bdecb03d60172caae48ca3e48bf395e
- SHA1 985532e6cd301686ab5d4e9aa1f3ff682bd59af1
- SHA512 d45765f112308a1a72d548cc2a618582c1724f524c2b81539c6e7801e32bba360751874d43beac4e1be12a4fbd2e8ddbef89b6387bcac50f64f20387d9bc12fd
- TLSH T14F0199165ADB0775C348E03918B447CAF610F855BD034E9D88C5974828B5293998CD9B
- MD5 SHA1 SHA512 TLSH